Effective date: 7 October, 2026
Last updated: 7 October, 2026
This policy explains what personal data Bangla Track collects, why, who we share it with, how long we keep it, and what choices you have. It covers:
- the Bangla Track web app (app.banglatrack.com) and our website (banglatrack.com);
- the Bangla Track WooCommerce plugin;
- the Bangla Track Shopify app.
We refer to all of these as the Services. “We”, “us” and “Bangla Track” mean Bangla Track, Mohammadpur, Dhaka, Bangladesh.
Contact for privacy questions and requests: support@banglatrack.com
1. Two roles: merchants and their customers
Bangla Track is a business management automation tool for online merchants in Bangladesh. That gives us two kinds of people’s data, and we are in a different position for each:
- Merchants (you, if you sign up). For your account, billing and use of the Services, we decide why and how your data is used. We are the “controller” of that data.
- Your customers (the recipients of parcels). When you book a delivery, you give us your customer’s name, phone number and address so that a courier can deliver the parcel. We handle that data on your behalf and on your instructions and only to provide the Services. You, the merchant, decide to collect it and are responsible for having a lawful basis and for telling your customers. We are the “processor” of that data.
2. What we collect
2.1 Merchant account data
- Name, email address, mobile phone number, and a password (stored as a one-way hash, never in readable form).
- If you sign in with Google: your Google email address, name, profile picture and Google account ID. We request only the basic openid, email and profile scopes.
- One-time passcodes (OTPs) sent to your phone or email to verify you, and records needed to prevent abuse (such as how many codes were requested).
- Your plan, subscription and payment records (see 2.7).
- Support requests you send us, including the name, email and message you provide.
2.2 Courier credentials
To book parcels with Pathao, Steadfast, RedX or Carrybee on your behalf, you give us your courier account credentials or API keys. We store them encrypted (AES-256-GCM) and use them only to talk to your courier on your instruction. We never sell them or show them to other merchants.
2.3 Order and recipient data
For each order you book: the recipient’s name, phone number, delivery address, order or invoice number, parcel description and weight, cash-on-delivery (COD) amount, delivery notes, the courier selected, consignment/tracking identifiers, and delivery status updates received from the courier.
2.4 Shopify app data
When you install the Shopify app we receive and store: your shop domain and shop name, an access token that lets the app act for your store (kept so the app can work), your plan, and, through Shopify’s order webhooks, the name, shipping address and phone number of the people who order from your store, together with the order total, payment method, weight, line items and notes needed to book a delivery. We do not collect customers’ email addresses or billing addresses. We also keep technical webhook logs and a short-lived job queue (see section 7). The app writes tracking numbers and delivery status back to your Shopify orders.
2.5 WooCommerce plugin data
The Bangla Track WooCommerce plugin runs on your own WordPress site. Its order, tracking and settings data is stored in your WordPress database (tables bt_order_meta and bt_tracking_logs and plugin settings) and is removed when you uninstall the plugin.
- Parcel bookings. When you book a parcel (one by one or in bulk), the plugin sends the recipient’s name, phone, address, COD amount and parcel details directly from your site to the courier you selected (for example Steadfast, Pathao, RedX or Carrybee). That booking data does not pass through Bangla Track’s servers.
- What the plugin sends to Bangla Track (banglatrack.com). To issue and check your licence or plan, check for updates and keep the service working, the plugin contacts our server when it is activated, when you save courier settings or finish the setup wizard, and roughly daily (and on a few-hours timer when you use the admin). It sends technical and licence information: your licence key and plan; your site URL, home URL and site name; your WordPress admin email address; the plugin, WordPress, WooCommerce and PHP versions; which couriers you have enabled and how many; the number of parcels booked this month; the activation ID/token; and the list of plugins installed on your site (name, version and whether each is active). For the free plan it also sends a site identifier, a hash of your site URL, an action name, timestamp and request ID.
- What the plugin does not send to Bangla Track: your customers’ names, phone numbers, addresses, tracking-recipient details or order line items.
- Customer-facing pages. If you enable the tracking shortcode or the customer timeline on your site, your customers see their own parcel status there; that data is served from your site. We use the plugin data above to operate the licence and plan system, provide updates and support, prevent licence abuse and understand compatibility.
2.6 Sales chats and AI order parsing
If you use the order-parsing feature, the text of a customer chat message (for example, a Facebook, Instagram or WhatsApp message) that you ask us to parse is sent to an AI model to extract the order details (name, phone, address, items, amount). This text may contain personal data. We send it to our AI providers (see section 4), and we log only technical information about each request (such as which model was used, how long it took, the message length and whether it succeeded), not the message itself.
2.7 Payments
Plan and add-on purchases are processed through our server and payment gateway provider (which supports Bangladeshi mobile-money and bank methods). We receive the order, amount, plan and a payment status/transaction reference. We do not receive or store your full card or mobile-money PIN details. On the Shopify app, plans are billed by Shopify through its Billing API; we receive the subscription status, not your payment details.
2.8 Technical and security data
IP address, browser/device type (user agent), timestamps, request logs, and error logs. We use Cloudflare Turnstile on sign-up, login and password-reset forms to block bots; it may process your IP address and browser signals to decide whether you are human.
2.9 Marketing and attribution data
If you arrive from an advertisement, we store the campaign parameters in the URL (UTM tags, and the Facebook fbclid and Google gclid click IDs) in your browser’s local storage and a first-party cookie for 90 days, so we can tell which campaign led you to sign up. We use Google Analytics 4, Google Ads conversion measurement and the Meta (Facebook) Pixel and Conversions API to measure our own advertising. For our own sign-ups and purchases, we may send Google/Meta event details and, for Meta, a hashed (SHA-256) version of your email, first name and phone number, together with your IP address and browser details, to match the conversion to the ad. This applies to visitors and merchants of banglatrack.com and the web app only; we do not do this with your customers’ data and we do not use recipient data for advertising. See section 9 for how to opt out.
2.10 Data we do not collect
We do not knowingly collect national ID numbers, financial account numbers, health data, biometric data or precise location data.
3. Why we use data
- To create and secure your account and verify you (OTP, Google sign-in, abuse prevention).
- To book, label, track and report on deliveries and to write status back to your store.
- To parse chat messages into orders when you ask us to.
- To send service messages by SMS or email, for example verification codes, order status alerts you enable, usage and plan notices, and support replies.
- To charge for plans and prevent fraud.
- To measure and improve our own marketing and the Services.
- To comply with the law and enforce our terms.
Our legal bases (where such concepts apply to you) are: performing our contract with you, our legitimate interests in running, securing and improving the Services, your consent where we ask for it (for example, optional marketing cookies), and legal obligations.
We do not sell personal data, and we do not use merchants’ or recipients’ data to train AI models.
4. Who we share data with
We share data only as needed to run the Services:
- Couriers you select (Pathao, Steadfast, RedX, Carrybee): recipient name, phone, address, COD amount and parcel details, to deliver the parcel. In the web app and Shopify app this goes through our servers; in the WooCommerce plugin it goes directly from your site. They process this under their own terms and privacy policies.
- Payment providers: UddoktaPay and WooCommerce (web app plans), Shopify (Shopify app plans).
- Communications providers: an SMS gateway (GreenWeb, Bangladesh) for verification codes and alerts, and our email delivery provider.
- AI model providers for order parsing: Google (Gemini) and OpenRouter and the model providers it routes to. We send only the message text needed for parsing.
- Google (sign-in, Analytics, Ads) and Meta (Pixel, Conversions API, and the Facebook/Instagram/WhatsApp connection if you use it), described in 2.6 and 2.9.
- Cloudflare (Turnstile bot protection).
- Shopify (the platform you install the app on) and your own store platform for the Shopify and WooCommerce integrations.
- Hosting and infrastructure providers that store our data.
- Authorities or advisers where required by law, to protect rights and safety, or in a business transfer (we will tell you if control of the data changes).
5. International transfers
Some providers above (Google, Meta, Cloudflare, OpenRouter, Shopify) process data in other countries, including the United States. Where required, we rely on appropriate safeguards such as contractual commitments.
6. Security
We use HTTPS for data in transit; per-shop authentication between the Shopify app and our backend (a token valid for one shop is useless for another); encryption of courier credentials at rest; hashed passwords; rate-limits, OTP-attempt lockouts and bot protection on sign-in; and access limited to staff who need it. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the relevant authorities as required by law.
7. How long we keep data
| Data | Retention |
| Merchant account | While your account is active; deleted or anonymised within 180 days after you close it, except records we must keep by law |
| WooCommerce plugin licence/site data we receive | While your licence or site is active, and 12 months after deactivation |
| Order and recipient data | While your account/app installation is active, so you keep booking and tracking history; after you uninstall the Shopify app, deleted when Shopify sends its shop-erasure request about 48 hours later |
| Shopify webhook queue copies | Completed jobs deleted after 7 days; failed jobs after 30 days |
| Customer erasure requests (Shopify customers/redact) | The recipient’s name and address are overwritten with “Redacted” and phone and email cleared |
| Courier credentials and Shopify access tokens | Until you disconnect/uninstall, then deleted |
| Payment records | 5 years as required for accounting and tax |
| OTP and abuse-prevention data | Short period, 24 hours to 30 days |
| Attribution cookie / local storage | 90 days |
| Server and security logs | 90 days |
8. Your rights and choices
Subject to applicable law, you can ask us to: access the personal data we hold about you; correct it; delete it; restrict or object to some processing; receive a copy in a portable format; and withdraw consent at any time. You can also close your account “by emailing us“.
If you are a merchant’s customer (a parcel recipient): because we process your data for the merchant, please contact the merchant first. You may also email us at support@banglatrack.com and we will pass the request to the merchant or act on it. For Shopify stores, we honour Shopify’s data-request and erasure requests automatically.
To exercise any right, email support@banglatrack.com. We will reply within 3 days. You may also complain to your data-protection authority.
9. Cookies, local storage and opting out
- Essential: a login/refresh-token cookie and browser storage for your session, theme and settings. Needed for the Services to work.
- Attribution and marketing (optional): the 90-day bt_attribution cookie/local-storage entry, Google Analytics, Google Ads and the Meta Pixel (section 2.9). You can block them in your browser or with an ad-blocker, clear the cookie and local storage, use Google’s opt-out add-on, or adjust your Meta ad preferences.
10. Children
The Services are for businesses and are not directed to anyone under 18. We do not knowingly collect data from children. If you believe we have, contact us and we will delete it.
11. Changes to this policy
We may update this policy. We will post the new version here with a new “last updated” date and, for material changes, notify merchants by email or in the app.
12. Contact
Bangla Track
Mohammadpur, Dhaka, Bangladesh
Email: support@banglatrack.com
Website: https://banglatrack.com